Subtechniques
Subtechniques literacy names parent-child technique hierarchy — T1059.001 PowerShell vs T1059.003 Windows Command Shell — on YOUR $TI_LAB mapping notes.
Visual · t33_subtechniques
Subtechniques literacy. $TI_LAB only. Original Cyberlium.
Precision matters — literacy teaches subtechnique IDs so detection rules and Navigator layers target the right behavior variant.
Subtechniques refine parent techniques — T1059 Command and Scripting Interpreter breaks into T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Visual Basic. Detection content tagged at parent level misses variant-specific logic; over-tagging at subtechnique without evidence creates false precision. Literacy names when to use each level. Cyberlium maps subtechniques on YOUR $TI_LAB — parent T1059 with two subtechniques and detection note for each. Next: Structure Lab.
1. Subtechnique hierarchy (named)
Parent technique: broader category — T1566 Phishing. Subtechniques: T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link, T1566.003 Spearphishing via Service. Notation: dot-separated ID. Data sources and platforms may differ per subtechnique.
On $TI_LAB, write parent-child tree — one parent with three subtechniques and one detection implication each.
Command guide
Try these commands — Subtechnique hierarchy (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE sub-techniques (https://attack.mitre.org/techniques/enterprise/); ATT&CK versioning (https://attack.mitre.org/resources/versions/); CISA (https://www.cisa.gov/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why subtechnique precision improves detection engineering
PowerShell-specific rule differs from cmd.exe rule — subtechnique ID guides content. Navigator heatmaps at subtechnique level reveal granular gaps. IR reports cite subtechnique when log evidence supports variant.
Students map subtechniques on lab scenarios — production rule tagging follows detection engineering standards.
3. Lab boundary
Forbidden: tagging live incidents at subtechnique without supporting evidence. Allowed: subtechniques card — parent-child tree with $TI_LAB fictional detection notes.
Ship: subtechniques card for YOUR lab mapping. Next: Structure Lab.
4. What you ship: subtechniques card for $TI_LAB
Parent-child tree with three subtechniques and detection notes. $TI_LAB named. chmod 600.
5. What you record before the next lesson
Date. Subtechniques card. $TI_LAB named. File t33-m04-l03-subtechniques.txt chmod 600.
6. Wrong vs right: criminal markets vs YOUR lab IOCs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Tag all executions as T1059 without subtechnique review. Invent subtechnique ID not in ATT&CK.
- Right: Write subtechniques card for YOUR $TI_LAB. Next: Structure Lab.
Mission: map subtechniques on YOUR lab
1) Pick one parent technique with three subtechniques. 2) Write correct dot-notation IDs. 3) Note one detection difference between subtechniques. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
T1059.001 and T1059.003 need different detection logic — subtechnique ID guides engineers.
APPLY: T1059.001 refers to:
APPLY: True or False: Subtechniques use dot notation under a parent technique.
APPLY: Subtechniques literacy on Cyberlium uses: